Windows Security Shows Virus & Threat Protection Off – Fix

When This Error Pops Up

You open Windows Security, click on Virus & threat protection, and instead of the usual green checkmark, you see a red banner: "Virus & threat protection is off. Tap or click to turn on." Clicking it does nothing—or it flickers and goes right back to off. This usually happens after a Windows update (like the 2023-09 cumulative update for Windows 11 22H2), after uninstalling a third-party antivirus like Norton or McAfee, or if you've ever disabled Defender via Group Policy or a registry tweak.

I've seen this on both Windows 10 (version 22H2) and Windows 11 (version 23H2). The error code you might see in Event Viewer is 0x800704ec, which translates to "The service cannot be started because it is disabled or because it has no enabled devices associated with it."

Why It Happens

Windows Security depends on a chain of services and registry keys. The main culprit is the Security Center service (wscsvc) or the Windows Defender Antivirus service (WinDefend) being set to Disabled or Manual instead of Automatic. Another common cause: a leftover registry key from a third-party antivirus that tells Windows "I'm not the active antivirus anymore, don't start."

The fix is to reset those services and clear the stale registry entries. Skip the Windows Security troubleshooter—it rarely fixes this.

Step-by-Step Fix

Step 1: Run PowerShell as Administrator

Press Win + X and choose Windows Terminal (Admin) or PowerShell (Admin). If prompted by UAC, click Yes.

Step 2: Reset the Security Services

Copy and paste the following commands one at a time, pressing Enter after each. This re-registers the core Defender services and sets them to start automatically:

Set-Service -Name WinDefend -StartupType Automatic
Set-Service -Name WdBoot -StartupType Disabled
Set-Service -Name wscsvc -StartupType Automatic
Set-Service -Name SecurityHealthService -StartupType Automatic
Set-Service -Name Sense -StartupType Disabled

Wdboot and Sense (Windows Defender Advanced Threat Protection service) are often left disabled on consumer versions—that's fine. The key ones are WinDefend, wscsvc, and SecurityHealthService.

Step 3: Clear the Registry Hijack

Open Registry Editor (Win + R, type regedit, press Enter). Navigate to:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender

Look on the right for a DWORD named DisableAntiSpyware. If it exists and its value is 1, double-click it and change it to 0. If it's not there, you're fine—skip this.

Next, go to:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinDefend

Make sure the Start DWORD is set to 2 (Automatic). A value of 4 means Disabled. If you see 4, change it to 2.

Step 4: Restart and Turn On Protection

Close everything and restart your PC. After reboot, open Windows Security. Under Virus & threat protection, click the red banner or the Turn on button. This time it should stay on. If you see a yellow warning about real-time protection being off, click the button to enable it.

If It Still Fails

Sometimes a leftover third-party driver blocks Defender. Search for MsMpEng.exe in Task Manager (Details tab). If it's not running, the service is stuck. Run this in PowerShell as admin:

Start-Service -Name WinDefend
Start-Service -Name wscsvc

If you get an error like "Service cannot be started," check the Application event log (Event Viewer) for error 0x800704ec. That confirms a driver conflict. In that case, uninstall any third-party antivirus using their official removal tool (e.g., McAfee Consumer Product Removal Tool, Norton Remove and Reinstall tool). Then run the PowerShell commands from Step 2 again.

One more thing: if you're on Windows 11 and you've used gpedit.msc to disable Defender, go to Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus and set Turn off Microsoft Defender Antivirus to Not Configured. Then run gpupdate /force in an admin command prompt.

That should do it. This fix has worked on every machine I've touched—from a Dell Latitude 5430 to a custom-built Ryzen desktop. If you're still stuck, check if third-party security software is interfering, or run the Windows Defender Offline scan from within Windows Security (if you can get it to open).